CVE-2026-59901: Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

July 22, 2026

The Bzip2Decoder handler in Netty’s compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [Bzip2BlockDecompressor.read()]

References

github.com/advisories/GHSA-558v-64gr-wgg4
github.com/netty/netty/releases/tag/netty-4.1.136.Final
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4
nvd.nist.gov/vuln/detail/CVE-2026-59901

Code Behaviors & Features

Detect and mitigate CVE-2026-59901 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →